Vulnerability Development: Re: aix ftpd

[alex medvedev <alexm () synthesys com>]

hallo,

On Fri, 30 Nov 2001, Peter Kovacs wrote:
> > i am pretty sure aix 4.3.3 ftpd will behave similarly.
> Not really.
>
> ftp> passive
> Passive mode on.
> ftp> ls
> 227 Entering Passive Mode (194,149,2,108,219,88)
> 150 Opening data connection for ..
> .profile
> 226 Transfer complete.
> ftp> ls ~{
> 227 Entering Passive Mode (194,149,2,108,219,92)
> 550 Unknown user name after ~
> ftp> ls
> 227 Entering Passive Mode (194,149,2,108,219,94)
> 150 Opening data connection for ..
> .profile
> 226 Transfer complete.
> ftp>by
> 221 Goodbye.
> [petke () risca]lslpp -l bos.rte|grep bos
>   bos.rte                   4.3.3.75  APPLIED    Base Operating System Runtime
>   bos.rte                    4.3.3.0  COMMITTED  Base Operating System Runtime
> [petke () risca]lslpp -l bos.\*|grep tcp
>   bos.msg.en_US.net.tcp.client
>   bos.net.tcp.adt           4.3.3.50  COMMITTED  TCP/IP Application Toolkit
>   bos.net.tcp.client        4.3.3.75  COMMITTED  TCP/IP Client Support
>   bos.net.tcp.server        4.3.3.75  COMMITTED  TCP/IP Server
it is strange, because i was able to reproduce the problem on 4.3.3 ml8
too (same fileset levels), even got a new error: ftp: bind: Address
already in use:

ftp> ls ~{
550 Unknown user name after ~
ftp: bind: Address already in use


also this is worth mentioning: note the commands i run and output i get in
the following session:

ftp> ls ~{
227 Entering Passive Mode (10,0,16,16,201,83)
550 Unknown user name after ~
ftp> ls ~{
150 Opening data connection for /bin/ls.
Passive mode refused.
ftp> ls ~{
226 Transfer complete.
ftp: connect: Connection refused
ftp> pwd
227 Entering Passive Mode (10,0,16,16,201,84)
ftp> pwd
227 Entering Passive Mode (10,0,16,16,201,85)
ftp> pwd
257 "/home/root" is current directory.
ftp> ls
257 "/home/root" is current directory.
257 "/home/root" is current directory.
ftp> ls
227 Entering Passive Mode (10,0,16,16,201,86)
150 Opening data connection for /bin/ls.
total 13031
-rw-------   1 root     system      1296 Oct 26 12:55 .TTauthority
-rw-------   1 root     system        98 Oct 26 12:54 .Xauthority
snipped
226 Transfer complete.

as you can see "ls" printed the output of "pwd" twice instead of file
listing.

btw, this was on aix 4.3.3 ml8

bye,

-alexm